Out-of-bounds read in Mozilla Firefox - CVE-2019-5849
Published: September 3, 2019
Vulnerability identifier: #VU20829
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-5849
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in Skia graphics library. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
Affected software
Mozilla Firefox
Google Chrome
Arch Linux
firefox (Ubuntu package)
Google Chrome
Arch Linux
firefox (Ubuntu package)
How to mitigate CVE-2019-5849
Install updates from vendor's website.
Mozilla Firefox - update to 69.0
firefox (Ubuntu package) - addressed in versions 69.0+build2-0ubuntu0.16.04.4, 69.0+build2-0ubuntu0.18.04.1, 69.0+build2-0ubuntu0.19.04.1, 69.0.2+build1-0ubuntu0.16.04.1, 69.0.2+build1-0ubuntu0.18.04.1, 69.0.2+build1-0ubuntu0.19.04.1
Google Chrome - update to 75.0.3770.80
firefox (Ubuntu package) - addressed in versions 69.0+build2-0ubuntu0.16.04.4, 69.0+build2-0ubuntu0.18.04.1, 69.0+build2-0ubuntu0.19.04.1, 69.0.2+build1-0ubuntu0.16.04.1, 69.0.2+build1-0ubuntu0.18.04.1, 69.0.2+build1-0ubuntu0.19.04.1
Google Chrome - update to 75.0.3770.80